{"type":"rich","author_name":"ThisIsOne","published":"2021-05-27 18:33:53","title":"SSRF via OpenID dynamic client registration\u3092\u3084\u3063\u3066\u307f\u305f","height":"190","author_url":"https://blog.hatena.ne.jp/ThisIsOne/","categories":["PortSwigger"],"url":"https://cysec148.hatenablog.com/entry/2021/05/27/183353","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fcysec148.hatenablog.com%2Fentry%2F2021%2F05%2F27%2F183353\" title=\"SSRF via OpenID dynamic client registration\u3092\u3084\u3063\u3066\u307f\u305f - Shikata Ga Nai\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","description":"Hello there, ('\u03c9')\u30ce OpenID\u52d5\u7684\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u767b\u9332\u306b\u3088\u308bSSRF\u3092\u3002 \u3053\u306e\u30e9\u30dc\u306f\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u5c02\u7528\u306e\u767b\u9332\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3092\u4ecb\u3057\u3066\u3002 OAuth\u30b5\u30fc\u30d3\u30b9\u306b\u52d5\u7684\u306b\u767b\u9332\u3067\u304d\u3066\u3002 \u4e00\u90e8\u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u56fa\u6709\u306e\u30c7\u30fc\u30bf\u306f\u3002 SSRF\u306e\u6f5c\u5728\u7684\u306a\u30d9\u30af\u30c8\u30eb\u3092\u516c\u958b\u3059\u308bOAuth\u30b5\u30fc\u30d3\u30b9\u306b\u3088\u3063\u3066\u3002 \u5b89\u5168\u3067\u306a\u3044\u65b9\u6cd5\u3067\u4f7f\u7528\u3055\u308c\u3066\u3002 \u4e0b\u8a18\u3078\u30a2\u30af\u30bb\u30b9\u3057\u3066\u3001\u30af\u30e9\u30a6\u30c9\u74b0\u5883\u306e\u30b7\u30fc\u30af\u30ec\u30c3\u30c8\u30a2\u30af\u30bb\u30b9\u30ad\u30fc\u3092\u76d7\u3080\u3089\u3057\u304f\u3002 http://169.254.169.254/latest/meta-data/iam/security-credentials/admin/ \u307e\u305a\u306f\u3001\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3002 \u30ea\u30af\u30a8\u30b9\u30c8\u304c\u9001\u4fe1\u2026","blog_url":"https://cysec148.hatenablog.com/","version":"1.0","width":"100%","provider_url":"https://hatena.blog","image_url":"https://cdn-ak.f.st-hatena.com/images/fotolife/T/ThisIsOne/20210527/20210527162802.png","blog_title":"Shikata Ga Nai","provider_name":"Hatena Blog"}